General
-
Target
1298b62fc3c9668e95a2d8af5f3c227afa87083c3e614.exe
-
Size
802KB
-
Sample
210601-1axksz4mxn
-
MD5
58fe2c2a4e7bdf9a1ea96b7e9242fcf1
-
SHA1
660d25a37871b8e05ded2e0ed2c3b0173d2948bb
-
SHA256
1298b62fc3c9668e95a2d8af5f3c227afa87083c3e614d48d01d01509316c3ec
-
SHA512
5024038a6f0978e28eb5f8a8f58528147f0f61391553113af85809634b4e08cec89480f4654c69a5241905c89006eea351ad79f746b3842d97912851b0ac7724
Static task
static1
Behavioral task
behavioral1
Sample
1298b62fc3c9668e95a2d8af5f3c227afa87083c3e614.exe
Resource
win7v20210410
Malware Config
Extracted
cryptbot
nimicw12.top
morqli01.top
-
payload_url
http://noirgf01.top/download.php?file=lv.exe
Extracted
danabot
1827
3
184.95.51.183:443
184.95.51.175:443
192.210.198.12:443
184.95.51.180:443
-
embedded_hash
AEF96B4D339B580ABB737F203C2D0F52
Targets
-
-
Target
1298b62fc3c9668e95a2d8af5f3c227afa87083c3e614.exe
-
Size
802KB
-
MD5
58fe2c2a4e7bdf9a1ea96b7e9242fcf1
-
SHA1
660d25a37871b8e05ded2e0ed2c3b0173d2948bb
-
SHA256
1298b62fc3c9668e95a2d8af5f3c227afa87083c3e614d48d01d01509316c3ec
-
SHA512
5024038a6f0978e28eb5f8a8f58528147f0f61391553113af85809634b4e08cec89480f4654c69a5241905c89006eea351ad79f746b3842d97912851b0ac7724
-
CryptBot Payload
-
Blocklisted process makes network request
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Drops startup file
-
Loads dropped DLL
-
Accesses cryptocurrency files/wallets, possible credential harvesting
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-